Managing Sanctioned Apps

Updated 3 hours ago by admin

Identifying which SaaS applications your organization should allow is an important step in securing your environment and controlling Shadow AI.

The Sanctioned App condition is available with Cloud Application Security and enforced through Web Security rules. It allows you to distinguish between applications that are explicitly approved and those that are not. By identifying sanctioned and unsanctioned application traffic, you can enforce policies to control access and reduce risk.

Setting an app as Sanctioned

Setting an app as Sanctioned identifies it as approved for use in your environment. This designation allows Web Security rules to treat the application as trusted and apply policies accordingly.

  1. Navigate to Security Modules -> Cloud Application Security -> App Catalog
  2. Search for the app by name or locate it in the tree
  3. On the right hand side, click the Sanctioned toggle so that it turns green.
  4. Repeat the process for other apps you would like to mark as sanctioned.

Controlling Sanctioned & Unsanctioned Apps

Once you have marked at least one app as sanctioned, you can apply security controls to sanctioned apps or to apps that do not appear on your sanctioned list.

  1. Navigate to Security Modules -> Web Security -> Filter Rules
  2. Create a new rule or edit and existing rule

To allow all traffic to Sanctioned Apps:

  1. Drag the Sanctioned App condition into the Selected Conditions column and configure it, by selecting some or all of the apps you have chosen to be sanctioned.
  2. Drag the Allow action into the Selected Actions column
  3. Position the rule above any existing rules that are used to block app activity. This ensures your preference to allow Sanctioned Apps triggers first
  4. User generated actions for your chosen Sanctioned Apps will be allowed and activity will be recorded in the Cloud Activity (Inline) report for analysis.

To block all traffic to Unsanctioned Apps:

  1. Drag the Sanctioned App condition into the Selected Conditions column and configure it by selecting all of the available apps
  2. Click Switch Logic to invert to a Does Not Match condition
  3. Drag the Template action into the Selected Actions column and select the template to use
  4. Drag the Block action into the Selected Actions column
  5. Position the rule after any rules that are used to allow Sanctioned Apps. This ensures the rule logic does not conflict
  6. Any user generated actions to App Catalog apps will be blocked unless they are to apps marked as sanctioned
The Sanctioned App condition targets user-generated actions. It is not intended to block at domain level. If you want to block the entire domain(s) of an app, please use the Custom URL module

Reviewing App Usage

  1. Navigate to Analytics -> Cloud Activity (Inline) and run a report
  2. App activity will be identified with a shield icon in front of the App Name.

    Icon colour

    Designation

    Description

    Green

    Sanctioned

    This application is approved for use and complies with company security policies.

    Orange

    Sanctioned Exception

    This application is approved, but a policy exception or negate rule is affecting how it is evaluated. Review rule configuration for details.

    Red

    Unsanctioned

    This application is not approved and may present security or compliance risk.

  3. To refine the results further, expand the Filters panel and use the Sanctioned App filter to show only results that match the type of designation you are searching for (see table above).

How did we do?